diff --git a/ansible/roles/gitea-runner/defaults/main.yml b/ansible/roles/gitea-runner/defaults/main.yml
index d364fca..972bcf8 100644
--- a/ansible/roles/gitea-runner/defaults/main.yml
+++ b/ansible/roles/gitea-runner/defaults/main.yml
@@ -36,3 +36,5 @@ docker_apt_source_line: >-
   deb [arch={{ docker_apt_arch }} signed-by={{ docker_gpg_key_path }}]
   https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
   {{ ansible_facts['distribution_release'] }} stable
+# Set to false in CI/molecule to skip rootless daemon startup (needs kernel userns)
+docker_rootless_setup: true
diff --git a/ansible/roles/gitea-runner/molecule/default/converge.yml b/ansible/roles/gitea-runner/molecule/default/converge.yml
index efefd4c..9f0e1e2 100644
--- a/ansible/roles/gitea-runner/molecule/default/converge.yml
+++ b/ansible/roles/gitea-runner/molecule/default/converge.yml
@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/deregister/converge.yml b/ansible/roles/gitea-runner/molecule/deregister/converge.yml
index 4d38b64..02353f7 100644
--- a/ansible/roles/gitea-runner/molecule/deregister/converge.yml
+++ b/ansible/roles/gitea-runner/molecule/deregister/converge.yml
@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "deregister-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml b/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml
index 72419bc..8567ef2 100644
--- a/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml
+++ b/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml
@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "lifecycle-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml b/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml
index ba72cc3..991877d 100644
--- a/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml
+++ b/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml
@@ -7,6 +7,7 @@
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-a"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
 
@@ -18,5 +19,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-b"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/template-content/converge.yml b/ansible/roles/gitea-runner/molecule/template-content/converge.yml
index dbabef5..81301ff 100644
--- a/ansible/roles/gitea-runner/molecule/template-content/converge.yml
+++ b/ansible/roles/gitea-runner/molecule/template-content/converge.yml
@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "template-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/molecule/update/converge.yml b/ansible/roles/gitea-runner/molecule/update/converge.yml
index 8eeb6f3..8ad9eee 100644
--- a/ansible/roles/gitea-runner/molecule/update/converge.yml
+++ b/ansible/roles/gitea-runner/molecule/update/converge.yml
@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "update-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
diff --git a/ansible/roles/gitea-runner/tasks/rootless_docker.yml b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
index 1732e28..063482b 100644
--- a/ansible/roles/gitea-runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
@@ -68,7 +68,9 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-  when: not rootless_docker_check.stat.exists
+  when:
+    - docker_rootless_setup
+    - not rootless_docker_check.stat.exists
 
 - name: Start rootless Docker daemon (systemd user service)
   ansible.builtin.command: systemctl --user start docker
@@ -77,6 +79,7 @@
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
   changed_when: true
+  when: docker_rootless_setup
 
 - name: Enable rootless Docker daemon (systemd user service)
   ansible.builtin.command: systemctl --user enable docker
@@ -85,6 +88,7 @@
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
   changed_when: true
+  when: docker_rootless_setup
 
 - name: Wait for rootless Docker daemon to be ready
   ansible.builtin.command: docker version
@@ -98,3 +102,4 @@
   retries: 10
   delay: 2
   changed_when: false
+  when: docker_rootless_setup